AWS Continuum for code vulnerabilities reaches general availability

General availability, with regional coverage to check

AWS announced general availability of AWS Continuum for code vulnerabilities on October 22, 2026. The service combines vulnerability discovery, exploitability validation, prioritization and remediation, according to the AWS launch announcement.

The announcement directs customers to the AWS Region table rather than listing supported Regions. Teams should verify availability in their intended deployment locations before planning adoption.

Environment context feeds remediation pull requests

AWS says Continuum for code vulnerabilities builds a context graph covering resource topology, identity relationships and network reachability. It ingests existing vulnerability findings, scans code and tests findings in an isolated sandbox to determine exploitability. AWS says the findings are then prioritized by business impact. These capabilities are described in the launch announcement.

According to AWS, remediation patches are delivered as pull requests with exploitability proof and a blast-radius assessment attached. The company also says Continuum selects AI models for individual tasks and works alongside Amazon GuardDuty and AWS Security Hub.

For engineering teams, the useful evaluation question is how well that context connects a code finding to the deployed application. Check whether the service’s view of application boundaries, identities and network reachability matches the actual environment, and whether the attached assessments provide enough detail to inform a patch review.

Approval first, autonomy within guardrails

Continuum starts in Learn mode, where it proposes remediation fixes for users to approve. Customers can switch to Enforce mode to allow autonomous action within guardrails they set, AWS says.

Treat that transition as a separate operational decision from enabling scanning. Before allowing autonomous remediation, define acceptable change scope, regression checks and rollback ownership. Review sandbox exploitability evidence alongside checks of application behavior, rather than treating it as a substitute for them.